feat(k8s): ACL CRUD + basic test

Author: Mia-Cross

internal/provider/provider.go

@@ -185,6 +185,7 @@ func Provider(config *Config) plugin.ProviderFunc {
 				"scaleway_ipam_ip":                             ipam.ResourceIP(),
 				"scaleway_ipam_ip_reverse_dns":                 ipam.ResourceIPReverseDNS(),
 				"scaleway_job_definition":                      jobs.ResourceDefinition(),
+				"scaleway_k8s_acl":                             k8s.ResourceACL(),
 				"scaleway_k8s_cluster":                         k8s.ResourceCluster(),
 				"scaleway_k8s_pool":                            k8s.ResourcePool(),
 				"scaleway_lb":                                  lb.ResourceLb(),

internal/services/k8s/acl.go

@@ -0,0 +1,274 @@
+package k8s
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/scaleway/scaleway-sdk-go/api/k8s/v1"
+	"github.com/scaleway/scaleway-sdk-go/scw"
+	"github.com/scaleway/terraform-provider-scaleway/v2/internal/cdf"
+	"github.com/scaleway/terraform-provider-scaleway/v2/internal/dsf"
+	"github.com/scaleway/terraform-provider-scaleway/v2/internal/httperrors"
+	"github.com/scaleway/terraform-provider-scaleway/v2/internal/locality"
+	"github.com/scaleway/terraform-provider-scaleway/v2/internal/locality/regional"
+	"github.com/scaleway/terraform-provider-scaleway/v2/internal/types"
+	"github.com/scaleway/terraform-provider-scaleway/v2/internal/verify"
+)
+
+func ResourceACL() *schema.Resource {
+	return &schema.Resource{
+		CreateContext: ResourceACLCreate,
+		ReadContext:   ResourceACLRead,
+		UpdateContext: ResourceACLUpdate,
+		DeleteContext: ResourceACLDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+		Timeouts: &schema.ResourceTimeout{
+			Create:  schema.DefaultTimeout(defaultK8SClusterTimeout),
+			Read:    schema.DefaultTimeout(defaultK8SClusterTimeout),
+			Update:  schema.DefaultTimeout(defaultK8SClusterTimeout),
+			Delete:  schema.DefaultTimeout(defaultK8SClusterTimeout),
+			Default: schema.DefaultTimeout(defaultK8SClusterTimeout),
+		},
+		SchemaVersion: 0,
+		Schema: map[string]*schema.Schema{
+			"cluster_id": {
+				Type:             schema.TypeString,
+				Required:         true,
+				ForceNew:         true,
+				ValidateDiagFunc: verify.IsUUIDorUUIDWithLocality(),
+				DiffSuppressFunc: dsf.Locality,
+				Description:      "Cluster on which the ACL is applied",
+			},
+			"acl_rules": {
+				Type:        schema.TypeList,
+				Required:    true,
+				Description: "The list of network rules that manage inbound traffic",
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"ip": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							Description:  "The IP subnet to be allowed",
+							ValidateFunc: validation.IsCIDR,
+						},
+						"scaleway_ranges": {
+							Type:        schema.TypeBool,
+							Optional:    true,
+							Description: "Allow access to cluster from all Scaleway ranges as defined in https://www.scaleway.com/en/docs/console/account/reference-content/scaleway-network-information/#ip-ranges-used-by-scaleway. Only one rule with this field set to true can be added",
+						},
+						"description": {
+							Type:        schema.TypeString,
+							Optional:    true,
+							Description: "The description of the ACL rule",
+						},
+						"id": {
+							Type:        schema.TypeString,
+							Computed:    true,
+							Description: "The ID of the ACL rule",
+						},
+					},
+				},
+			},
+			// Common
+			"region": regional.Schema(),
+		},
+		CustomizeDiff: cdf.LocalityCheck("cluster_id"),
+	}
+}
+
+func ResourceACLCreate(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
+	api, _, err := newAPIWithRegion(d, m)
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	region, clusterID, err := regional.ParseID(d.Get("cluster_id").(string))
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	_, err = waitCluster(ctx, api, region, locality.ExpandID(clusterID), d.Timeout(schema.TimeoutCreate))
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	acls, err := expandACL(d.Get("acl_rules").([]interface{}))
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	createReq := &k8s.SetClusterACLRulesRequest{
+		Region:    region,
+		ClusterID: clusterID,
+		ACLs:      acls,
+	}
+
+	_, err = api.SetClusterACLRules(createReq, scw.WithContext(ctx))
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	regionalID := regional.NewID(region, clusterID).String()
+	d.SetId(regionalID)
+
+	return ResourceACLRead(ctx, d, m)
+}
+
+func ResourceACLRead(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
+	api, region, clusterID, err := NewAPIWithRegionAndID(m, d.Id())
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	_, err = waitCluster(ctx, api, region, clusterID, d.Timeout(schema.TimeoutRead))
+	if err != nil && !httperrors.Is404(err) {
+		return diag.FromErr(err)
+	}
+
+	acls, err := api.ListClusterACLRules(&k8s.ListClusterACLRulesRequest{
+		Region:    region,
+		ClusterID: clusterID,
+	}, scw.WithContext(ctx))
+	if err != nil {
+		if httperrors.Is404(err) {
+			d.SetId("")
+
+			return nil
+		}
+
+		return diag.FromErr(err)
+	}
+
+	_ = d.Set("cluster_id", clusterID)
+	_ = d.Set("acl_rules", flattenACL(acls.Rules))
+
+	return nil
+}
+
+func ResourceACLUpdate(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
+	api, region, clusterID, err := NewAPIWithRegionAndID(m, d.Id())
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	_, err = waitCluster(ctx, api, region, clusterID, d.Timeout(schema.TimeoutUpdate))
+	if err != nil && !httperrors.Is404(err) {
+		return diag.FromErr(err)
+	}
+
+	if d.HasChange("acl_rules") {
+		acls, err := expandACL(d.Get("acl_rules").([]interface{}))
+		if err != nil {
+			return diag.FromErr(err)
+		}
+
+		req := &k8s.SetClusterACLRulesRequest{
+			Region:    region,
+			ClusterID: clusterID,
+			ACLs:      acls,
+		}
+
+		_, err = api.SetClusterACLRules(req, scw.WithContext(ctx))
+		if err != nil {
+			return diag.FromErr(err)
+		}
+	}
+
+	return ResourceACLRead(ctx, d, m)
+}
+
+func ResourceACLDelete(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
+	api, region, clusterID, err := NewAPIWithRegionAndID(m, d.Id())
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	_, err = waitCluster(ctx, api, region, clusterID, d.Timeout(schema.TimeoutDelete))
+	if err != nil && !httperrors.Is404(err) {
+		return diag.FromErr(err)
+	}
+
+	allIPRange, err := types.ExpandIPNet("0.0.0.0/0")
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	req := &k8s.SetClusterACLRulesRequest{
+		Region:    region,
+		ClusterID: clusterID,
+		ACLs: []*k8s.ACLRuleRequest{
+			{
+				IP: &allIPRange,
+			},
+		},
+	}
+
+	_, err = api.SetClusterACLRules(req, scw.WithContext(ctx))
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	_, err = waitCluster(ctx, api, region, clusterID, d.Timeout(schema.TimeoutDelete))
+	if err != nil && !httperrors.Is404(err) {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}
+
+func expandACL(data []interface{}) ([]*k8s.ACLRuleRequest, error) {
+	expandedACLs := []*k8s.ACLRuleRequest(nil)
+
+	for _, rule := range data {
+		r := rule.(map[string]interface{})
+		expandedRule := &k8s.ACLRuleRequest{}
+
+		if ipRaw, ipSet := r["ip"]; ipSet && ipRaw != "" {
+			ip, err := types.ExpandIPNet(ipRaw.(string))
+			if err != nil {
+				return nil, err
+			}
+
+			expandedRule.IP = &ip
+		}
+
+		if scwRangesRaw, scwRangesSet := r["scaleway_ranges"]; scwRangesSet && scwRangesRaw.(bool) {
+			expandedRule.ScalewayRanges = scw.BoolPtr(true)
+		}
+
+		if descriptionRaw, descriptionSet := r["description"]; descriptionSet && descriptionRaw.(string) != "" {
+			expandedRule.Description = descriptionRaw.(string)
+		}
+
+		expandedACLs = append(expandedACLs, expandedRule)
+	}
+
+	return expandedACLs, nil
+}
+
+func flattenACL(rules []*k8s.ACLRule) interface{} {
+	if rules == nil {
+		return nil
+	}
+
+	flattenedACLs := []map[string]interface{}(nil)
+
+	for _, rule := range rules {
+		flattenedRule := map[string]interface{}{
+			"id":              rule.ID,
+			"scaleway_ranges": rule.ScalewayRanges,
+			"description":     rule.Description,
+		}
+		if rule.IP != nil {
+			flattenedRule["ip"] = rule.IP.String()
+		}
+
+		flattenedACLs = append(flattenedACLs, flattenedRule)
+	}
+
+	return flattenedACLs
+}